Hi and welcome back to Section 8 web
application attacks.
In this video, you will learn how to discover authentication failures
on a vulnerable web application. I hope you're excited.
So let's try phone in.
Sometimes a web application may not
be configured to handle use authentication and simply
allow Bon authorized users such as let's say
hackers to gain access to restricted
resources on the web server.
If a web application authentication mechanism is designed
poorly then it retractor can simply perform
various types of attacks such as Brute
Force password spring and even credential
stuffing unused default user credentials
as we to gain access to the web application
on the web server. Sometimes web
administrators use the full configurations default
user cones, uneven week
passwords, which simply enables the attacker to
perform a Cyber attack on the
web app in this video. We will take a look at actually exploiting on
authentication failure on the Juice
Shop web application to get started simply open
your terminal.
and let's run the docker container
for Juice Shop like so
Great, so note. The docker container is running.
Let's open our web browser.
Which is Firefox?
And ensure the proxy settings for boob Suite
it is not an evil So currently we can see it is
tuned off to use the default Firefox settings.
Simply Go to http colon slash
slash one to seven.
Dot 0.0.1
Cool on and Port 3000 EXO.
Simply click on account and ensure that
you are not logged in as administrator account if you
are simply select the logout option.
Let's click on this drop-down menu
here and let's click on the scoreboard.
Next let's select broke on Authentication.
like so
let's scroll down just a little bit.
And here you can see we have another exercise which is called login
as Jim. So apparently Jim is
a valid user on this
web application and the idea is to login
into gyms account. So let's do that.
Let's click back on the home page here like so and
now that we are on all products so you
can see all the products that are being sold on this Juice
Shop web application.
Let's say that you are an ethical hacker a penetration tester.
Well, how could we determine a valid user credential
or how can we determine whether a user context?
We can simply click on a call.
And let's take a look at the login page on the
login page. There's an option that allows you to
reset a user's password. So let's
click forgot your password.
Now that we click this speech we have seen that it is
asking for a valid user email address.
A security question on the new password before we
enter any credentials. Let's turn
on the boob Suite proxy settings.
And now let's launch boob Suite.
Let's ensure the proxy settings are configured correctly.
Let's turn on intercept.
And let's head over back to the web application and refresh the
page to generate some traffic.
Let's forward all of these request messages.
Let's click on target.
And let's select this first option.
Which is each GDP colon slash slash.
One two, seven zero zero
one coolant 3000 right click
and select add to scoop.
Simply select. Yes.
I know click anyway here on this
bar.
And simply select the option show only in
screw items and click apply.
create
so now that we are only focusing on the specific URL.
Let's click on proxy one more time and forward any remaining traffic.
Great.
That's how about to all web application?
on the web application
we have learned that all the users users add juice
Dash each dot o
p do mean
So therefore let's assume that Jim's credential or gyms
email address is gim guice.
-sh.op
greet
If we click inside this box that says
security question.
You should see the security question appearing.
However, right now it's not clickable perhaps they
are HTTP requests that needs to be forward on
boob Suite. So let's follow them.
And just like that we can see the security question appearing for
Jim which is your Elvis siblings
middle name.
Let's follow any additional requests once more.
Well to put simply we continue off intercept just temporarily.
For the security question, let's create something.
Let's just create some traffic.
So for the security question, I will type 1
2 3 as answer.
For the password. I'm just going to use password.
I'm going to repeat it pesswrd like
so.
and now
I'm going to turn on intercept on boob
Suite.
And then I'm going to click on change create.
Notice what has happened here?
Poop sweet actually captured the pulse message.
Here you can see the email address that I entered.
the answer to the security question
and the new password that I wanted to change on Jim's
account since you have captured this post requests.
Let's send this to intruder.
Intruder will simply allows to perform a dictionary
based attack or even a Brute Force attack.
Let's right click.
And select send to intruder.
Create let's click on Intruder now.
On Intruder simply click on Clay as
you can see we have Claire on the right hand side.
Great.
This will simply clear any placement positions
within the HTTP code.
for the answer one, two three, simply highlighted
like so
and simply click on ADD
this will set a policeman value.
next let's select the plow tab
with an intruder like so
on the Pluto tab
on the pilot options
we can simply select around time.
Great.
So to peel type is now set to runtime file.
Excellent.
Now it's time to add all file. Let's simply
click on select file.
And let's navigate to the directory of Slash
user / share slash passwords
and we'll select the roku.txt file.
ensure you select the rock you 30xc file
like so
and click on open.
Great.
Once you are ready to start our attack simply click on
start attack like so
select ok
and we are looking for an HTTP 200 status
code.
With this attack, it will simply try every possible
wood within the woodless itself.
So once it's fine a valid name, we
should see an HTTP status code of 200.
Currently the status codes of 300 400
500 seats ideas. No actual
connections. However, after the attack
is finished because simply fill the status code. I
look for one that says 200 like so
As we can see with two hundred this means
a successful connection between boob Suite
while specifically between Intruder and actual
web application.
At this point we have determined that the actual answer
is Samuel.
So let's have our back to the proxy settings here.
Let's turn it off.
Let's head over back to the web application.
And we have seen we are successfully completed challenge in
resetting James fastwood.
So now we know.
The eldest sibling middle name is Samuel
with a capital S. And the
password to login into gyms account is no
set to password create.
During the course of this video you have learned how to
discover an authentication is you and even exploited on
a vulnerable web application.
In the next video, you will learn how to exploit cryptographic failures.
I hope this video has been informative for
you and I will see you in the next one.